The risk committee has endorsed the adoption of a security system development life cycle
(SSDLC) designed to ensure compliance with PCI-DSS, HIPAA, and meet the organization’s
mission. Which of the following BEST describes the correct order of implementing a five phase
SSDLC?

A.
Initiation, assessment/acquisition, development/implementation, operations/maintenance and
sunset.

B.
Initiation, acquisition/development, implementation/assessment, operations/maintenance and
sunset.

C.
Assessment, initiation/development, implementation/assessment, operations/maintenance and
disposal.

D.
Acquisition, initiation/development, implementation/assessment, operations/maintenance and
disposal.